Using suspend policies with Cayosoft Administrator

Content: 

Overview

Cayosoft Administrator provides rich suspend capabilities for user and group accounts in both Active Directory and Office 365. There are two primary methods to suspend users or groups in Cayosoft Administrator: manually via Web Portal and automated with automation rules.

Web Portal provides Suspend and Undo Suspend actions on users and groups. These actions can be granularly delegated with roles and controlled via Change History.

A rich set of various automation rules allows for revealing stale objects and automatically suspending them according to to suspend policies.

Both methods can use the default suspend policies, which need to be set up only once. For a more granular approach, different suspend policies can be configured for each automation rule or Admin Unit, as described below.

Specifying default suspend policies

To set the default Suspend Policies:

1. Open Cayosoft Administrator.

2. Navigate to Active Directory Extension settings.
3. Expand the Cayosoft Suspend Policies section.
4. Specify policies by clicking the select button and choosing the files you created using the Suspend Active Directory Snap-in described in the previous section. For more information, please see Creating and saving user suspend policies article.
5. Click Save at the bottom right of the configuration page.

Automating suspend operation with automation rules

Cayosoft Administrator provides an automated suspension of users and groups in bulk with the help of automation rules. These rules will run by schedule and perform a suspension in compliance with defined settings.

To create a Suspend Rule:

1. Open the Cayosoft Administrator Console

2. Click New Rule

3. Check Cayosoft Suspend then click Next

4. Click Users or Groups then click Next

5. Choose the desired automation rule:

   1. AD Users | Suspend Expired AD Users
   2. AD Users | Suspend Users
   3. Office 365 Users Inactive | Suspend Users
   4. Text file | Suspend AD Users
   5. Import SQL Data | Suspend AD Users
   6. Import Oracle Data | Suspend AD Users 
   7. AD Users | Enforce Object Retention (Delete)
   Note: Each of these rules can be configured to simultaneously suspend an Office 365 user account, linked to the target Active Directory user account. For more information, please see Suspend | Office 365 User rule article.

6. Click Next

7. Choose the Report Output type (for example choose Create and Save a Report)

8. Click Next

9. Update the name of the rule or change the folder then if needed, then click Finish

10. Click Preview to see what objects will be returned by the Rule

Providing manual Suspend and Undo Suspend operations in Web Portal

In Cayosoft Web Portal you can perform an immediate or scheduled suspend and undo suspend operations. The scheduled operation would be performed on a date and time, defined by a user. Scheduled operation is available only for Active Directory Accounts and Hybrid Accounts. Cloud-only accounts can be Suspended\Undo Suspended only immediately. 

If you perform scheduled Suspend\Undo Suspend for the Hybrid account, the related Office 365 account will be also Suspended\Undo Suspended by the defined schedule. 

You need to perform these steps to configure suspend and undo suspend functionality in Web Portal. See details for each step in the sections below.

1. Configure the Suspend User and Undo Suspend User web action.

2. If you have a hybrid environment, configure the Suspend | Office 365 User and Undo Suspend | Office 365 User built-in rules.

3. If you plan to use an option to defer suspend or undo suspend operations to a specific date in the future, then you need to configure the Process Scheduled Suspend Operations runbook. This runbook will check if a suspend or undo suspend operation is pending execution and trigger the Suspend\Undo Suspend rules configured in a previous step.

4. If you need to enforce a different suspend process in some departments, configure Admin Units with different suspend policies.

Configuring Suspend User web action

When you suspend an Active Directory user, you can also suspend the related Office 365 user, in case you have a hybrid environment:

1. In Administrator Console navigate to Home > Configuration > Connected Systems Extensions > Active Directory.

2. Expand Cayosoft Suspend Policies section.

3. Set Run related Office 365 user suspend and undo suspend to Yes.

4. Click Save Changes.

5. Navigate to Home > Configuration > Web Portal > Web Actions.

6. Click Active Directory > Suspend User web action.

7. Check that Suspend related Office 365 user is not No.

8. Click Save Changes.

9. If you are running a hybrid environment and you need to simultaneously suspend an Office 365 user account, related to the target Active Directory user account, you also need to configure  Suspend | Office 365 User rule.

Configuring Undo Suspend web action

When you undo suspend Active Directory user, you can also undo suspend the related Office 365 user, in case you have a hybrid environment:

1. 1. In Administrator Console navigate to Home > Configuration > Connected Systems Extensions > Active Directory.

2. Expand Cayosoft Suspend Policies section.

3. Set Run related Office 365 user suspend and undo suspend to Yes.

4. Click Save Changes

5. Navigate to Home > Configuration > Web Portal > Web Actions.

6. Click Active Directory > Undo Suspend web action.

7. Check that Undo Suspend related Office 365 user is not No.

8. Click Save Changes.

9. If you are running a hybrid environment and you need to simultaneously unsuspend an Office 365 user account, linked to the target Active Directory user account, you also need to configure Undo Suspend | Office 365 User.

Configuring scheduled suspend and undo suspend

When you use Scheduled Suspend and Undo Suspend actions, the target objects must be periodically checked to see if a suspend or undo suspend action is needed. Cayosoft Administrator can perform the necessary checks and actions automatically.

For more information on how to process the scheduled suspend operations according to the date and time set on the object, please see this KB20180621-1 article.

Specify individual suspend policies at the administrative unit level

To set individual Suspend Policies for an Administrative Unit:

1. Open Cayosoft Administrator console

2. Navigate to Active Directory Extension settings

3. Expand Cayosoft Suspend Policies section

4. Specify policies by clicking the select button and choosing the files you created using the Suspend Active Directory Snap-in described in the previous section

5. Click Save at the bottom right of the configuration page